Test Equipment Anonymous (TEA) group therapy thread

[Mr. Scram]

That’s 99% of the routers out there for reference.

That's one of those things you can actually influence. A zero day is game over anyway.

[bd139]

If it's an authentication bypass, like the listed one above, then MAC whitelisting would stop escalation. Always ask, if this defence falls, what's the next one?  If you have one it's game over on a zero day. Layered security is the name of the game.

Which is why:

1. Strong password.
2. Up to date router software
3. Quality router (Netgear is not quality for ref)
4. Fixed service support lifecycle and good history of handling CVEs.
4. MAC whitelisting
5. Run the whole thing as if it was a public WiFi AP.

Cisco, ZyXel, Juniper, Draytek, Fritzbox or nothing.

Edit: here's a current shit sandwich: https://badpackets.net/over-19000-orange-livebox-adsl-modems-are-leaking-their-wifi-credentials/

Edit 2: also to add, the biggest problem isn't the WiFi AP but the internet connection surface.

Edit 3: I'm on holiday. Why am I doing security consultancy, on an electronics forum, especially for free?

[med6753]

Why do you say Netgear is not quality stuff? I've never had any issues and I've been running a Netgear router for years. And my model was not listed as having authentication issues.

Firmware is up to date.
Strong passwords, including admin
Network is shut down when I'm not home.
I regularly monitor who/what is on my network

Never heard of MAC whitelisting until now.  And I don't kid myself. If someone is bound and determined to get into my network nothing will stop them.

[Mr. Scram]

If it's an authentication bypass, like the listed one above, then MAC whitelisting would stop escalation. Always ask, if this defence falls, what's the next one?  If you have one it's game over on a zero day. Layered security is the name of the game.

Which is why:

1. Strong password.
2. Up to date router software
3. Quality router (Netgear is not quality for ref)
4. Fixed service support lifecycle and good history of handling CVEs.
4. MAC whitelisting
5. Run the whole thing as if it was a public WiFi AP.

Cisco, ZyXel, Juniper, Draytek, Fritzbox or nothing.

Edit: here's a current shit sandwich: https://badpackets.net/over-19000-orange-livebox-adsl-modems-are-leaking-their-wifi-credentials/

Edit 2: also to add, the biggest problem isn't the WiFi AP but the internet connection surface.

Who needs a zero day when boxes get shipped with backdoors already installed? At least some of those brands got busted doing that, accidentally or not.

Besides, if they're in the network they should be able to sniff and spoof an existing MAC address. It doesn't add a layer or stop escalation.

[med6753]

Forgot to mention......after 3 minutes of inactivity this laptop goes to sleep. And any of the other PC's/laptops on my network are shut down (no sleep or hibernate) if not in use. There's no data on the Kindle Fire or Cell that would be of much use to anyone.

[bd139]

Why do you say Netgear is not quality stuff? I've never had any issues and I've been running a Netgear router for years. And my model was not listed as having authentication issues.

Firmware is up to date.
Strong passwords, including admin
Network is shut down when I'm not home.
I regularly monitor who/what is on my network

Never heard of MAC whitelisting until now.  And I don't kid myself. If someone is bound and determined to get into my network nothing will stop them.

Netgear don't define a service life for their consumer stuff. Nor do they have a great reputation for responding to CVEs. They sometimes just go "meh" and ignore them. Your router might have not been listed because (a) they don't care or (b) it's not vulnerable or (c) it is vulnerable but it is outside of the service life they don't document. They don't specify this.

Who needs a zero day when boxes get shipped with backdoors already installed? At least some of those brands got busted doing that, accidentally or not.

Besides, if they're in the network they should be able to sniff and spoof an existing MAC address. It doesn't add a layer or stop escalation.

Yes which is why you need layered security.

You can't sniff a MAC address if you can't get a MAC address to start with because you need a MAC address on the network for the router to respond to you initially. If MAC whitelisting is turned on that can't happen. Once you are on you can use 802.11 probe frames to do this but the nature of the problem is that MAC whitelisting prevents that very vector. But if you are vulnerable to that, someone is already on your network so it's game over anyway.

Which is incidentally why you need layered security and to treat your WiFi network as a public one. Then the next jump is through the computer's firewall. Which is VERY difficult when it assumes that the network you are connected to is a public one (unless network location awareness on windows has fucked itself, which happens all the damn time)

[med6753]

I just went through all the possible settings for both the Netgear cable modem and the Netgear router and there's absolutely no mention of MAC whitelisting. No wonder I never heard of it. So how does one implement it?

[bd139]

Probably doesn't have it on that netgear model. May be hidden under another name or option. On Fritzbox:



This prevents new MAC addresses being registered even if they pass authentication

[Mr. Scram]

I just went through all the possible settings for both the Netgear cable modem and the Netgear router and there's absolutely no mention of MAC whitelisting. No wonder I never heard of it. So how does one implement it?

Not all routers have it, but it's normally in the options somewhere. I wouldn't bother with it.

[Specmaster]

If it's an authentication bypass, like the listed one above, then MAC whitelisting would stop escalation. Always ask, if this defence falls, what's the next one?  If you have one it's game over on a zero day. Layered security is the name of the game.

Which is why:

1. Strong password.
2. Up to date router software
3. Quality router (Netgear is not quality for ref)
4. Fixed service support lifecycle and good history of handling CVEs.
4. MAC whitelisting
5. Run the whole thing as if it was a public WiFi AP.

Cisco, ZyXel, Juniper, Draytek, Fritzbox or nothing.

Edit: here's a current shit sandwich: https://badpackets.net/over-19000-orange-livebox-adsl-modems-are-leaking-their-wifi-credentials/

Edit 2: also to add, the biggest problem isn't the WiFi AP but the internet connection surface.

Edit 3: I'm on holiday. Why am I doing security consultancy, on an electronics forum, especially for free?

Haha that's an easy one, you're doing it because you can [emoji1787]

[med6753]

I think I found it....."turn on access control"

[med6753]

I think I found it....."turn on access control"

Confirmed....I found it. In detail. When all else fails RTFM. 

[Mr. Scram]

Some reading material. It's not the best site around for the nitty gritty technical details, but they're not far off here.

https://www.howtogeek.com/202441/your-wi-fi%E2%80%99s-wpa2-encryption-can-be-cracked-offline-here%E2%80%99s-how/
https://www.howtogeek.com/204458/why-you-shouldn%E2%80%99t-use-mac-address-filtering-on-your-wi-fi-router/

[tautech]

Have a look at SDG1032X, 30 MHz sine and square and can be improved to the 60 MHz model. 

Ah...and how ?
Say for dummies like me in this case ?
Using the keygen for my former scope dg1054z was easy, for the siglent it´s rather complicated I guess….

Some info here and in the Siglent ads thread.
https://www.eevblog.com/forum/testgear/siglent-sdg1000x-waveform-generators/

[Specmaster]

Some reading material. It's not the best site around for the nitty gritty technical details, but they're not far off here.

https://www.howtogeek.com/202441/your-wi-fi%E2%80%99s-wpa2-encryption-can-be-cracked-offline-here%E2%80%99s-how/
https://www.howtogeek.com/204458/why-you-shouldn%E2%80%99t-use-mac-address-filtering-on-your-wi-fi-router/

The best security is to avoid wireless entirely or avoid the sort of data that people crave and keep everything backed up if it has sentimental value or can't be replaced.

[bd139]

Some reading material. It's not the best site around for the nitty gritty technical details, but they're not far off here.

https://www.howtogeek.com/202441/your-wi-fi%E2%80%99s-wpa2-encryption-can-be-cracked-offline-here%E2%80%99s-how/
https://www.howtogeek.com/204458/why-you-shouldn%E2%80%99t-use-mac-address-filtering-on-your-wi-fi-router/

This is actually totally wrong. If you look at my vendor choices above, you'll see that they all support 802.11w or ac on supported lines.

Since 802.11ac, this must support PMF (protected management frames) derived from 802.11w. Windows 8+, recent anything since about 2009 supports this i.e. Linux , BSD, OSX, all NOS platforms. This stops this class of attacks.

If you're running arse end consumer stuff (hence vendor approval list I have), or anything more than about 5 years old (hence lifecycle support I mentioned) then you are fine.

But again, if you treat your wireless network as an insecure public network, this doesn't matter really. Which is the point of layered security!

Some reading material. It's not the best site around for the nitty gritty technical details, but they're not far off here.

https://www.howtogeek.com/202441/your-wi-fi%E2%80%99s-wpa2-encryption-can-be-cracked-offline-here%E2%80%99s-how/
https://www.howtogeek.com/204458/why-you-shouldn%E2%80%99t-use-mac-address-filtering-on-your-wi-fi-router/

The best security is to avoid wireless entirely or avoid the sort of data that people crave and keep everything backed up if it has sentimental value or can't be replaced.

You don't have to avoid WiFi at all. Just make sure that you treat it as an insecure network. If you run TLS 1.2+ over it, meh. Most people run their WiFi like their home toilet; comfy, warm and you know where it's been. But in reality it's a piss soaked metal toilet with syringes down the back next to the beach at Clacton.

100% agree with backups.

[mnementh]

If it's an authentication bypass, like the listed one above, then MAC whitelisting would stop escalation. Always ask, if this defence falls, what's the next one?  If you have one it's game over on a zero day. Layered security is the name of the game.

Which is why:

1. Strong password.
2. Up to date router software
3. Quality router (Netgear is not quality for ref)
4. Fixed service support lifecycle and good history of handling CVEs.
4. MAC whitelisting
5. Run the whole thing as if it was a public WiFi AP.

Cisco, ZyXel, Juniper, Draytek, Fritzbox or nothing.

Edit: here's a current shit sandwich: https://badpackets.net/over-19000-orange-livebox-adsl-modems-are-leaking-their-wifi-credentials/

Edit 2: also to add, the biggest problem isn't the WiFi AP but the internet connection surface.

Edit 3: I'm on holiday. Why am I doing security consultancy, on an electronics forum, especially for free?

1) Non-sequitur passphrases with special characters are one of the best security measures out there. You still have to suck it up and type 20-40 characters to get a decent one, but unlike typical random characters, you can actually remember them, which means (hopefully) fewer bits of paper lying around with valid credentials on them. Change the username on the Admin account. Delete unnecessary accounts.

2) Yup. Done. Will probably do it again if I can find an openWRT build for this thing.

3) FAIL.  But hey... $21.  Quality is as quality does; fortunately with routers that's 95% FW.

4) FAIL. LOL... this thing could very well BE an exploit from the Chinese government. But they've been around for several years, and have good ratings, considered. Part of why I wanna do a backup of everything. I suppose I could do my own build of openWRT; it's based on a supported MT7621AT "Router-on-a-Chip" chipset... but fuck man... the last time I compiled a *NIX kernel from scratch, I think I still had hair. 

4) Yup. That's how we started this whole "thing". 

5) Yup. File & Printer sharing gets broken every time Windoze decides to "make Windoze better" anyways, so fuggitt.

mnem
 

[Mr. Scram]

I'm not disagreeing with layered security. It's just that whitelisting tends to be a feel-good measure if the attacker is any good with the standard tooling out there. You could have spent that time on more effective measures.

If you don't want information out there, don't put it on a computer. Anything more advanced than the simplest microcontroller is guaranteed to be full of holes and oversights. Forget anything that actually runs an OS. It boils down to your data being safe due to no one really taking an interest.

[beanflying]

Rule one of internet security should be work on the theory there is ALWAYS someone out there who is smarter than you are. No matter what you have in place it can be broken by someone on the planet if they really want to and have the skillset. Remember big brother is 'real' 

Take your sensitive stuff (if its that important, like Government Conspiracy evidence, 'bedroom videos'....) offline and off network like backups for example. Take sensible precautions but much above that is fairly pointless.

Anyone seriously wanting to your vital data is more likely to knock on your front door with a Gun or Baseball bat or pay your house a visit when you are out as it is so much easier and needs far less skill to get your passwords that you hid in a 'safe' place.

Sitting here in my little village of 1800 populated by retired farmers typing this under my tin foil hat 

[med6753]

After looking over all the BS needed to screw with the MAC whitelist plus reading the articles where it really doesn't buy you a whole hell of a lot I said fuck it....not going to bother. I think I have sufficient security measures in place. And I think chances of someone coming out here to my rural location to snoop is fairly remote. A strange car parked or someone hanging around would stand out like a sore thumb.

Mnem.....file and printer sharing. You have to beat Win10 into submission to get it to play nice on a mixed network. When I first got this laptop I spent days trying to get it to join the network of Win7 machines and set up file and printer sharing. Services.msc is your friend and finally found the right combination of stuff that needed to be running in order to connect and STAY connected. Since that time everyone is happy and Windoze updates have NOT broken it.     

[mnementh]

Some reading material. It's not the best site around for the nitty gritty technical details, but they're not far off here.

https://www.howtogeek.com/202441/your-wi-fi%E2%80%99s-wpa2-encryption-can-be-cracked-offline-here%E2%80%99s-how/
https://www.howtogeek.com/204458/why-you-shouldn%E2%80%99t-use-mac-address-filtering-on-your-wi-fi-router/

The article about rate limiting is pretty much SysOp 101 stuff... yet is is disturbing how often it is not implemented, even in this age. The article about MAC filtering is a complete conflation of disparate concepts based on an incorrect understanding of the OSI model, and if it were on a security wiki it would have been flagged by now. 

Bottom line is unless you've already cracked the encryption, you can't even get an IP address. If you've already cracked the encryption, you don't NEED an IP address to passively infiltrate the network, and getting an IP address is easy. This article assumes you're running some prehistoric halfbreed between TKIP and modern WPA where all your header information is sent in cleartext. 

Yes, as I said before... SOMEONE WHO KNOWS WHAT THEY'RE DOING CAN STILL CRACK YOUR WIFI. But those people aren't INTERESTED in some broken-down old dumbass like me and my kitchen to-do list and emails to my wife in the next room. The people who are interested in my home network are bored kids who don't have anything better to do than look for somebody's credit card numbers left lying around, and they don't know what they're doing.

In all honesty, I'm a LOT more worried about the idea that my router came from the manufacturer with a payload preinstalled than I am about the time I'm "wasting" on MAC address filtering. I know that it got rid of persistent parasites on my own home network, so I'm gonna keep using it no matter how many people who supposedly "know better" tell me I'm wasting my time.

If I'm willing to "waste the time" to set up my network this way, I can be reasonably sure the average script-kiddie is gonna get bored and move on to the next, easier target. If somebody REALLY wants my passphrase, they'll "hack the wetware" or "whack the brainpan" with a blunt object until they get it. If they can do that, they have physical possession of my entire network, so don't NEED my password. 

It's like the old joke about two guys running away from a hungry grizzly bear; I'm putting on my sneakers now, because I know I don't have to outrun the bear... I just have to outrun my neighbor. 

After looking over all the BS needed to screw with the MAC whitelist plus reading the articles where it really doesn't buy you a whole hell of a lot I said fuck it....not going to bother. I think I have sufficient security measures in place. And I think chances of someone coming out here to my rural location to snoop is fairly remote. A strange car parked or someone hanging around would stand out like a sore thumb.

Mnem.....file and printer sharing. You have to beat Win10 into submission to get it to play nice on a mixed network. When I first got this laptop I spent days trying to get it to join the network of Win7 machines and set up file and printer sharing. Services.msc is your friend and finally found the right combination of stuff that needed to be running in order to connect and STAY connected. Since that time everyone is happy and Windoze updates have NOT broken it.

I've had printer and file sharing working on Windoze 10 and broken by a Windoze update 3 times since "upgrading" from Windoze7.

Breaking your shit... just one of the many "services" of Winbloze-as-a-Service.   

Once you have your whitelist collected, it's really not that much hassle... even when you're moving to new network infrastructure. Unless you have a device like this one I just got, where the data entry is not only inconvenient, it is downright anti-intuitive; almost designed to fight the user using it. 

So NOT like my CCNA coursework days... where your whitelist was a CSV file you'd copy & paste from the terminal. 

mnem
Be a PITA. The bastards will move on to greener pastures... or bury you in one.

[beanflying]

Microsoft to drop edge and adopt Chrome backbone https://www.dailymail.co.uk/sciencetech/article-6460719/Microsoft-kill-Edge-browser.html

Wonder how long before they screw that up too by 'incorporating' it into Windoze

[mnementh]

I still use Edge... whenever I want to log into the FarceBook account I made JUST for my 3DP groups. I do wish TEVO would host a proper support forum. 

Windoze adopting Chrome browser core...? sounds to me like the Queen of Data Disruption is courting the King of Data Mining... Guess I'll have to adopt Opera as my 2nd string browser. 

mnem
My dual rates are so hot they're twitchy.

[beanflying]

I still use Edge... whenever I want to log into the FarceBook account I made JUST for my 3DP groups. I do wish TEVO would host a proper support forum. 

Time to go back to FF from Chrome which is becoming way to 'intergrated' into everything I do.
It's a bizarre thing 3DP users and manufacturers adopting a terrible solution of Farcebook as a pseudo forum. Good information just gets lost in the dross and can't be searched easily. ##Last FBook login 6 months ago all apps removed including Instagram and Twitter is on notice 

[mnementh]

I still use Edge... whenever I want to log into the FarceBook account I made JUST for my 3DP groups. I do wish TEVO would host a proper support forum. 

Time to go back to FF from Chrome which is becoming way to 'intergrated' into everything I do.
It's a bizarre thing 3DP users and manufacturers adopting a terrible solution of Farcebook as a pseudo forum. Good information just gets lost in the dross and can't be searched easily. ##Last FBook login 6 months ago all apps removed including Instagram and Twitter is on notice 

Yeah, well, doing that allows the infrastructure to all be on someone else's dime.

I dumped Chrome over a year ago, whenever it was that FF first ran their "Anti-Bloat, Anti-Big Brother" campaign. A "decrapified" FF was all I wanted when I switched away to Chrome years ago anyways. 

https://youtu.be/lcwmDAYt22k

Okay... so (besides me) who here's actually looking forward to the "new" Transformers movie with the REAL BumbleBee?

mnem
"Shuddup, man... Ahh knowwitt."